IAM credentials may be compromised and unusual API calls may occur.
Use managed threat intelligence and log analysis.
Which service is most appropriate?
Enable Amazon GuardDuty to analyze relevant AWS logs and threat intelligence for malicious activity.
Detailed explanation
DNS TTL does not respond to compromised IAM credentials.
DNS TTL does not respond to compromised IAM credentials.
S3 lifecycle management neither detects nor blocks API threats.
S3 lifecycle management neither detects nor blocks API threats.
GuardDuty analyzes sources such as CloudTrail, VPC Flow Logs, and DNS logs for threats.
GuardDuty analyzes sources such as CloudTrail, VPC Flow Logs, and DNS logs for threats.
Config evaluates configuration compliance rather than threat-intelligence-based activity.
Config evaluates configuration compliance rather than threat-intelligence-based activity.
Check official documentation
Compare the following points with the official documentation.
Amazon GuardDuty threat detectionの公式説明を確認する。
What to confirm
設定準拠評価と脅威検知サービスを区別できる。
Key points
- GuardDuty
- Threat intelligence
- CloudTrail log
Notes
- Environment: AWS公式SOA-C03試験ガイドとAWS公式ドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Detection versus prevention
GuardDuty raises findings; a separate response workflow decides how to contain them.
Multiple signals
Combining API, network, and DNS evidence improves detection context.